Sophos SAVDI antivirus plugin for Moodle 4.1+
Copyright © 2017–2020 The University of Southern Queensland (https://www.usq.edu.au)
This plugin adds virus scanner support for the Sophos SAVDI daemon to Moodle 4.1 and newer. These scanner (SAVDI daemon) and web server combinations are supported:
- Scanner on the same host as the web server, web server files readable by the scanner. Requires 'allowscanfile' option be FILE, DIR, or SUBDIR in the scanner configuration. Connection may be via Unix domain socket or TCP/IP.
- Scanner on the same host as the web server, web server files not readable by the scanner. Requires 'allowscandata' be YES in the SAVDI configuration. Connection may be via Unix domain socket or TCP/IP.
- Scanner on a different host to the web server. Requires 'allowscandata' be YES in the SAVDI configuration. Connection is via TCP/IP, so ensure any relevant network and host firewalls allow communication with the daemon.
See the Troubleshooting section below for common deployment issues.
The Sophos Simple Scanning Protocol is documented in these references:
See also the Example savdid.conf for an annotated "local to web server" SAVDI configuration.
Troubleshooting
These error messages may be sent to administrators of the Moodle site.
Could not open item passed to SAVI for scanning
The scanner could not directly open and read from the scan file on its filesystem. If the scanner is local to the web server, try enabling the "Change scan file permissions" setting. If the scanner is not local to the web server, enable the "SAVDI daemon is remote" setting.
Scan terminated due to timeout
The scanner gave up scanning a file due to its 'maxscantime' threshold being exceeded.
SAVDI server does not support request type SCANDATA
The scanner does not have the 'allowscandata' option enabled, which is required if the scanner is remote to the web server.
Data size exceeds SAVDI server limit of nnn bytes
The size of the file being scanned exceeded the 'maxscandata' limit configured in the scanner. A value of 0 for 'maxscandata' sets no limit.
Example savdid.conf
Full documentation of this file can be found at https://www.sophos.com/en-us/medialibrary/PDFs/documentation/SAVDI_User_Manual.pdf.
threadcount: 30
maxqueuedsessions: 2
virusdatadir: /opt/sophos-av/lib/sav
idedir: /opt/sophos-av/lib/sav
onexception: REQUEST
onrequest: REQUEST
log {
type: FILE
logdir: /var/log/savdi
loglevel: 2
}
channel {
commprotocol {
type: UNIX
socket: /var/run/savdid.sock
mode: all
# Or alternatively...
# type: IP
# address: 127.0.0.1
# port: 4010
requesttimeout: 5
}
scanprotocol {
type: SSSP
logrequests: YES
# Options are: NO, FILE, DIR, SUBDIR
allowscanfile: SUBDIR
# Options are: NO, YES
allowscandata: YES
# Byte size of largest file to scan, or 0 for unlimited size.
maxscandata: 1048576
}
scanner {
type: SAVI
inprocess: YES
maxscantime: 3
maxrequesttime: 10
savigrp: GrpExecutable 1
savigrp: GrpArchiveUnpack 1
savigrp: GrpSelfExtract 1
savigrp: GrpInternet 1
savigrp: GrpMSOffice 1
# For local-to-webserver use, list the PHP temporary upload directory
# here. Beware that modern Linux distribution web servers may use
# private temporary directories which make uploaded files inaccessible
# to the scanner.
allow: /var/tmp/php
}
}
